Forum Discussion

arpydays's avatar
arpydays
Icon for Nimbostratus rankNimbostratus
Aug 20, 2015

APM and Multi-Tenancy

Hi,

 

I was wondering about the constraints of using a single APM instance to host multiple customers. I already understand the alternatives i.e. spinning up separate VEs or even vCMP, but a lot of infrastructure I work with does support multi-tenancy in some way within a logical instance and it can be a good way to consolidate services in a shared infrastructure environment.

 

I work with F5 gear a lot and understand the underlying features to enable this i.e. partitions and route domains and have used these features to achieve multi-tenancy with LTM and ASM. With APM there may be some more challenges with certain services. AAA resources was the first issue I came across when first investigating this a few years ago, i.e. it didn't support route domains for AAA resources like AD servers. This feature has been added as of 11.5. The other core feature I think may be a problem is DNS, last time I checked this out DNS servers could only be allocated in RD0 and only one set i.e. can't allocate per customer DNS (not talking about DNS servers passed to client for VPN) so resolution of customer resources for certain services may be problem.

 

I'd be interested to hear about anyone's experiences or views on using APM for multi-tenancy,

 

cheers

 

APM
design
security

1 Reply

Sort By
  • Amit_Karnik_269's avatar
    Amit_Karnik_269
    Icon for Nimbostratus rankNimbostratus
    Aug 28, 2015
    Interested in this topic as well. We are not implementing multi-tenancy but we did have a lot of issues with doing APM and multiple route-domains. For example Java-based-RDP started supporting route-domains only with 11.6.0+HF4. Also for our SSLVPN access, we have a separate route-domain (e.g. %1), but I observe that certain traffic does not work well with that. For e.g. when a DHCP broadcast happens on the SSL-VPN subnet, we wanted to setup a DHCP relay VS and relay the DHCP requests out our DHCP servers (like cisco ip-helper) but never got it to work. cheers.